HTTP Status CodesRunbook 0/4 done
429

HTTP Status Codes Error 429: Too Many Requests

Warning↻ Retryable · exponential backoffHTTP 429 Too Many RequestsAPI Gateway
TL;DR · 10-second read

The client sent more requests than the server's rate limit allows in the window. Wait Retry-After seconds, then retry with exponential backoff and jitter.

Identify: does your log match?

What you see · exact log / response
HTTP/1.1 429 Too Many Requests
Retry-After: 30
RateLimit-Limit: 100
RateLimit-Remaining: 0
RateLimit-Reset: 30
Content-Type: application/json

{"error":"rate_limited","message":"Rate limit exceeded: 100 requests per 60s"}
  1. High

    Unbounded parallel requests

    Promise.all over hundreds of items or several workers sharing one API key exceed the per-key quota instantly.

  2. Medium

    Retry storm after an outage

    Clients retry failed calls immediately and in sync, multiplying traffic right when the server recovers.

  3. Low

    Shared IP quota

    Rate limits keyed on IP count all users behind a NAT or a serverless platform's egress as one client.

Fix

Retry with Retry-After and jittered backoff

✕ Broken · TypeScript
while (true) {
  const res = await fetch(url);
  if (res.status !== 429) break;
}
✓ Fixed · TypeScript
for (let attempt = 0; attempt < 6; attempt++) {
  const res = await fetch(url);
  if (res.status !== 429) return res;
  const ra = Number(res.headers.get('retry-after'));
  const base = Number.isFinite(ra) && ra > 0 ? ra * 1000 : 500 * 2 ** attempt;
  await new Promise(r => setTimeout(r, base + Math.random() * base * 0.2));
}
throw new Error('rate limited after 6 attempts');

The busy loop makes the limit worse. Honoring Retry-After and adding jitter spreads retries out.

Verify: reproduce it on purpose

Reproduce locally · curl
$ curl -i https://httpbin.org/status/429

Run it against a dev environment to trigger 429 on purpose and test your error handler.

Prevent

  • Read RateLimit-Remaining and slow down before hitting 0.
  • Use a queue with fixed concurrency for bulk jobs.
  • Cache GET responses you request repeatedly.

FAQ

Is Retry-After in seconds or a date?

Either. RFC 9110 allows delay-seconds or an HTTP-date; handle both.

Should I retry POST on 429?

Yes if the request was rejected before processing, which 429 implies, but send an idempotency key to be safe.

What is the difference between 429 and 503?

429 blames the client's request rate. 503 means the server is overloaded or in maintenance for everyone.

Related errors

Last verified 2026-10-20 · Source: IANA HTTP Status Code Registry (RFC 9110) · Official docs ↗ · ~33,100 searches/mo